fix(qt): update py7zr to 1.1.3, closing six advisories the toolchain carried

[rldyourmnd]

Follow-up to #183, found by the scanners that could finally see the closure.

What locking revealed

dependency-review and fixture / osv-scan both failed on #183. Not on anything the
PR introduced — on what the Qt toolchain had been installing all along:

py7zr==1.0.0
  GHSA-q6rc-2cgv-63h7   Arbitrary File Write
  GHSA-gjrg-mpp7-g774   Decompression bomb (zip bomb) DoS   (also PYSEC-2026-2972)
  GHSA-h4gh-22qq-72r7   O(n²) algorithmic complexity DoS    (also PYSEC-2026-2973)
  PYSEC-2026-2974

All fixed in 1.1.3.

The exposure predates the lock. uvx --with 'py7zr==1.0.0' installed exactly that
version. What changed is that an uninventoried closure cannot be scanned: dependency
review and OSV had no manifest to read, so six advisories in the library aqtinstall
uses to unpack Qt archives — including arbitrary file write — went unreported.

That is the argument for locking, made by the locking.

After

27 packages checked against OSV, 0 with advisories

requirements-qt.in → py7zr==1.1.3, recompiled with hashes. aqtinstall declares
py7zr>=0.22.0, so it is satisfied. qt-ci.yml's published LOCK_SHA256,
catalog/tools.yml's lock_sha256 and pin, and
tests/fixtures/sdk-runtime-spec.yml's py7zr_version all moved together —
check_qt_toolchain_lock.py fails if they do not.

Evidence

Run 31856452245:

success  fixture / qt-ci / qt (6.8.3)
success  observe / qt-ci

The SDK byte manifest was regenerated through the launcher, and proven_digest and
last_run updated only after the run succeeded.

Remaining, not fixed here

dependency-review also warns that texttable has an OpenSSF Scorecard of 2.1 against
this repository's threshold of 3. That is a warning rather than a failure, it is a
transitive dependency of aqtinstall with no alternative available, and swapping it is a
separate decision from patching a known-vulnerable package. Stated rather than left to
be rediscovered.

Verification

• validate_all — all tiers OK with GH_TOKEN · actionlint — clean
• every package in the closure re-queried against OSV